Quantcast
Channel: Forensic Focus Forums - Recent Topics
Viewing all articles
Browse latest Browse all 20109

Mobile Phone Forensics: Cellebrite PA Hex Dump searching question

$
0
0
Thanks for the replies. Having revisited this issue this morning to follow up Alex's suggestion the search now works! As it turns out the numbers I had seen (which could be represented as ASCII) are stored big endian and the search tool highlights the numbers (\x00\x30\x00\x37 etc etc). Tired eyes and brain yesterday afternoon saw that the number was followed by \x00 and hence thought the number was stored little endian unicode. To answer the original question posed I have tested a "binary dump" comprising of some text encoded little endian unicode. PA Find function appears only to find BE encoded unicode. What I still don't understand is why the search works today and didn't yesterday. I think I did the same thing but user error is suspected! Regards,

Viewing all articles
Browse latest Browse all 20109

Trending Articles